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Abstract — Recently, an information theoretical model for 
Quantum Secret Sharing (QSS) schemes was introduced. By 
using this model, we prove that pure state Quantum Threshold 
Schemes (QTS) can be constructed from quantum MDS codes 
and vice versa. In particular, we consider stabilizer codes and 
give a constructive proof of their relation with QTS. Furthermore, 
we reformulate the Monotone Span Program (MSP) construction 
according to the information theoretical model and check the 
recoverability and secrecy requirement. Finally, we consider QSS 
schemes which are based on quantum teleportation. 

I. Introduction 

QSS schemes are used to share a quantum secret among 
a set of players such that only specific groups of players 
are able to reconstruct the secret (authorized sets), while 
all other groups have no information about the secret at all 
(unauthorized sets). The collection of unauthorized sets is 
called the adversary structure, which has the property that 
every subset of an unauthorized set is also unauthorized. 

In [11], an information theoretical model for a QSS scheme 
was defined. This model is used throughout the rest of this 
paper and is repeated here. Suppose one wants to share a 
secret S which is an element of a g-dimensional Hilbert 
space Tts, where q usually is a prime power. The elements 
{|0), |1), . . . , \q — 1)} form an orthonormal basis for Hs and 
we usually describe the state of the secret by its orthonormal 
decomposition ps — 2~2iew a i\i) (A- The reference system that 
purifies the state of S is denoted by R with corresponding 
Hilbert space Hr. Finally, the secret is shared among a 
set of players P = {Pi,...,P n } and the Hilbert space 
corresponding to a set B C P is denoted by TLb- The density 
matrix ps then describes the state of system B. 

The model is defined as follows. We denote the mutual 
information between systems R and A by l(R : A) = S(R) + 
S(A) — S(RA), where S(A) is the Von Neumann entropy of 
the state pa of system A. 

Definition 1: A QSS scheme realizing an adversary struc- 
ture A is described by a quantum operator which generates 
quantum shares from a quantum secret S and distributes these 
among the players such that: 

1) recoverability requirement: 

for all A <£ A we have that l(R : A) = l(R : S); 

2) secrecy requirement: 

for all B e A we have that l(R : B) = 0. 



A scheme that satisfies these conditions is called a perfect 
scheme. In a non-perfect scheme, some sets have some 
information about the secret, but not enough to recover it, i.e. 
^ l(R : B) < l(R : S) for some unauthorized set B. 

In this paper, we investigate Quantum Threshold Schemes 
(QTS) and their relation with Quantum Error Correcting Codes 
(QECC). In [6], it was shown that a ((*, 2t - 1)) QTS can 
be constructed from a [[2t — 1,1, t]]k quantum code. Here, 
we give an information theoretical proof of this relation and 
also prove the reverse statement. In particular, we consider 
stabilizer codes and constructively show how these codes can 
be used for secret sharing. It is possible to compute the reduced 
density matrix of a subset of shares, by only making use of 
the properties of the stabilizer. 

Furthermore, we reformulate the Monotone Span Program 
(MSP) construction [8] for a general adversary structure ac- 
cording to Definition ^ By directly computing the reduced 
density matrix of a set of shares, we verify that the recover- 
ability and secrecy requirement are satisfied. 

Finally, the construction of a non-perfect ((n, n)) QTS using 
teleportation, as was proposed in [9], is reformulated in terms 
of the information theoretical model. We show that authorized 
sets satisfy the recoverability requirement, but unauthorized 
sets have some, but not enough, information about the secret. 

II. Pure and Mixed state QSS schemes 

In a pure state scheme, the encoding of a pure state of 
the secret is a pure state, while with a mixed state scheme the 
encoding of a pure state is sometimes a mixed state. In general, 
a QSS scheme is mixed, but it can be described as a pure 
scheme with one share discarded [7]. Therefore, it actually 
suffices to only consider pure state schemes, which have the 
following useful property. Part of it was previously considered 
in [11], but a full proof is given here. 

Theorem 2: In a pure state QSS scheme, the recoverability 
requirement and the secrecy requirement are equivalent. 

Proof: Suppose P is the set of all players and let A,BC 
P such that B = P \ A. Using the Araki-Lieb inequality and 
the fact that the systems RS and RAB are in a pure state, we 
have 

l(R : S) - l(R : A) = l(R : B) (1) 



and the theorem follows immediately. ■ 
Note that this also implies that in a pure state scheme, the 
authorized sets are precisely the complements of the unautho- 
rized sets and vice versa. Moreover, this implies that a pure 
state ((t,n)) QTS satisfies n = 2t — 1. 

III. QSS with Quantum MDS codes 

In the classical case, a linear (t, n) threshold scheme over 
¥ q can be constructed from an [n + 1, t, n + 2 — t] q MDS 
code and vice versa [1]. We show that in the quantum case, a 
[[2t — 1, l,t]] q quantum MDS code can be used to construct 
a ((t,2t — 1)) QTS and vice versa. As a special case, 
binary stabilizer codes are considered and the recoverability 
requirement is checked by directly computing the entropies 
of the reduced density matrices of a subset of shares. 

A quantum code can correct for erasures on a subsystem 
of the system of the codewords means that the operator 
that induces the erasures is perfectly reversible. The quantum 
data processing inequality [3] gives a necessary and sufficient 
condition for a quantum operator to be perfectly reversible. 

A different condition for quantum erasure correcting is 
given by Theorem |4] Cerf et al. [4] previously proved the 
necessity of this condition. First we need the following lemma, 
which is given without proof. 

Lemma 3: Let A and B be two quantum systems. If A or 
B is in a pure state, then the composite system AB is in a 
product state. 

Theorem 4: Let Q be a quantum system and let R be its 
reference system, such that RQ is in a pure state. Erasures 
can be corrected on some subsystem Q e of Q if and only if 

hi: ■.().: o. 

Proof: Let Q — Q u Q e and suppose we can correct 
for erasures on Q e . This means that every quantum operator 
acting on Q e and leaving Q u invariant is perfectly reversible. 
Let £ be a quantum operator that converts the system Q e 
into an arbitrary pure state and let pr'Q' u q^ be the system 
Prq u q c after applying I (g) I £. Then pr'q> q' is in the 
product state pr>q< ® pq< (Lemma |3} and S{R'Q' u Q' e ) = 
S(R'Q'u) + S(Q'e) = S(RQu) + S(Q' e ). Analogously, we 
have that S(Q u Q' e ) — S(Q U ) + S(Q' e ). Furthermore, because 
of the quantum data processing inequality we have S(Q) = 
S(Q') - S(R'Q') and therefore 

= S(Q)-S(Q') + S(R'Q') 

= S(R) - S(Q u Q' e ) + S(RQ u Q' e ) 

= S(R) - S(Q U ) - S(Q' e ) + S(RQ U ) + S(Q' e ) 

= S{R) - S{RQ e ) + S{Q e ) = l(R:Q e ), (2) 

which completes the first part of the proof. 

On the other hand, suppose l(R : Q e ) = for some 
subsystem Q e of Q. Let £ be a quantum operator acting on 
Q e . Then £ has a representation as a unitary evolution on a 
larger system, say Q e E, where E is initially in a pure state. 
Let R'Q'E' be the system RQE after this unitary evolution 
on Q e E and leaving RQ U invariant. Then because of the 



conservation rule for mutual information (see for example 
[10]) we have that 

l(R' : Q' e E') = l{R : Q e E). (3) 

Since E was initially in a pure state, we have (using Lemma 

13 

l(R : Q e E) = S(R) + S(Q e E) - S(RQ e E) 

= S{R) + S(Q e ) + S{E) - S(RQe) - S(E) 

= l(R:Qe). (4) 

Furthermore, because of the strong subadditivity property for 
system R'Q' e E' we have 

l(R' : Q' e E') - l(R' : E') > 0, (5) 

which implies that 

< l(R' : ET) < l(R' : Q' e E') = l(R : Q e ). (6) 

Thus if l(R : Q e ) = then also l(R' : E') = 0, which 
is equivalent to S(Q) = S(Q') — S(R'Q') and therefore 
because of the quantum data processing inequality erasures 
can be corrected on Q e . ■ 

Now we have the tools to prove the general relation between 
quantum MDS codes and QTS. 

Theorem 5: A ((t,2t — 1)) QTS, where the secret is an 
element of a ^-dimensional Hilbert space, can be translated 
into a [[2t — 1, 1, t]] q quantum MDS code and vice versa. 

Proof: Consider a ((t,2t - 1)) QTS with system S of 
the secret, reference system R and system of the players P. 
Then the secrecy requirement states that for every set of at 
most t — 1 players B, we have l(R : B) = 0. According 
to Theorem 0] we have that erasures can be corrected on the 
shares of any set of t — 1 players. Hence, all possible sets of 
shares in P together form a \[2t — 1, 1, t]] q QECC. 

On the other hand, consider a [[2t — 1, 1, t]] q quantum MDS 
code. We claim that each codeword can be the shares for a 
((i, 2t — 1)) QTS. Indeed, if Q is the composite system of 
the codewords and R the reference system, then for every set 
Q e of at most t — 1 of the 2t — 1 subsystems of Q we have 
l(R : Qe) = (Theorem |4}- Hence, the secrecy requirement 
is satisfied. Moreover, because of Theorem|2and the fact that 
a ((i, 2t — 1)) QTS is a pure state scheme, we also have that 
the recoverability requirement is satisfied. ■ 

Stabilizer Codes 

We consider a [[2t — 1, 1, t]]2 quantum stabilizer code with 
stabilizer T. We show that this code can be used to construct 
a ((i, 2t — 1)) QTS and verify the recoverability requirement, 
which is sufficient because the scheme is pure. First, we 
present the following technical lemma. 

Lemma 6: Let W £ Q n , where Q n denotes the Pauli group 
on n qubits, act on a composite quantum system Q = Q\®Q2 
and say W = W\® W2, where Wi acts on system Qi,i = 1,2. 
Suppose ) is a state of system Q that is stabilized by W . 
If P2 = tridV'HV'IX where tri is the trace over system Qi, 
then W2 and p2 commute with each other. 



Proof: Let A be an arbitrary quantum operator acting on 
the state space of system Q2 and tr2 the trace over system 
Q2- Then we have 

tr 2 (p 2 A) = tra^ifl^MMW^A) 

= tra^apaWjU), (7) 

where we have used that the trace function is cyclic and the 
fact that Wi W\ — I if W\ is a tensor product of Pauli 
matrices. Since this holds for any A acting on the state space 
of system Q2 we have that pi = W2P2W2 which completes 
the proof. ■ 

Next let T be generated by {G\, . . . ,€21-2} and let ~X 
and Z be the logical Pauli X and Z operators on the logical 
basis {|0l),|1l)} for the stabilizer code (see [10]). Then 
{Gi, . . . , G2t-2, X, Z} forms a basis for the commutator 
C(T) of T. Since an MDS code is pure [5], we have that 
T has minimum distance t + 1 and C(T) minimum distance 
t. This results in the following property, which we mention 
here without proof. 

Lemma 7: If we restrict the generators of C(T) to at most 
t — 1 qubit positions, then the restricted generators of C(T) 
remain independent. 

We claim that the construction for the ((t, 2t — 1)) threshold 
scheme is given by the following isometry. 

Definition 8: The mapping V t , 2 t-i ■ C 2 -> (C 2 )® 2 *- 1 is 
defined by 

Vt,M-i(ao|0) + ai|l)) = ao|0 L > +ai|lL>, (8) 
where olq, ot\ £ C. 

So if the secret is in state ps — ao|0)(0| +ai|l)(l|, the state 
of the system of the shares P is given by 

pp = V t ,2t-iPsVl 2t _ x =ao|0 z ><0 L |+ai|l£}<lz|. (9) 

The entropy of every possible subset of shares from P is 
given by the following lemmas. 

Lemma 9: Let B C P with \B\ = t' < t — 1. Then we have 
for the entropy of the state ps of system B 

S(B)=t'\og2. (10) 
Proof: Suppose B is a set of t — 1 qubits. Let G'j be the 
operator Gj restricted to the qubit positions of B for every 
1 < j < 2t — 2. Because of Lemma |6] these operators G'j 
all commute with ps- Moreover, because of Lemma the 
operators G'j are still independent. Since ps is a 2* _1 x 2* -1 
density matrix that commutes with 2t — 2 independent elements 
in Qt-i we have that ps — l/2 t ~ 1 I. In general, for any set 
B of at most t—1 shares, say t', we have that ps = 1/2* I. 

■ 

Lemma 10: Let A C P with \A\ = t. Then we have for the 
entropy of the state pa of system A 

S(A) = S(S) + (t-l)log2. _ f JU) 
Proof: Consider a set A of t shares. Let G' } ■„ X and Z be 
the operators Gj, X and Z restricted to the qubit positions in A 
respectively for every 1 < j < 2t — 2. Then these 2t operators 



are independent because of Lemma Since |0l)(0l| and 
commute with G'j for every j and also with Z, we 

can write 

p\ = tr A c(|0 L )(0 L |) = I/®* +/ 3 i?; (12) 

p\ = tr A c(|l L )(l L |) = ^iM+fcR, (13) 

where R e {I,X,Y,Z}®\R ^ I® 1 and < |/3 |,|/3i| < 
1/2*. The operator R cannot commute with X , since then it 
would commute with 2t independent operators, which would 
imply that R = I® 1 . Therefore, since R and X are tensor 
products of Pauli matrices, R anti-commutes with X . Hence, 
because X 7 tr^(|0 i )<0 i |)X' t = tr A =(|l L )(l L |), we have 
that Po = -(3i. 

Furthermore, p A has 2 t_1 eigenvalues equal to 1/2* + [3q 
and 2 t_1 equal to 1/2* — (3q, because R has 2* _1 eigenvalues 
equal to +1 and 2 t ~ 1 equal to —1. We also know that 
S{p° A ) = S(p° AC ) = (t- l)log2, since |0 L )(0 L | has zero 
entropy. Therefore, we have that fio = ±1/2*. Analogously 
for [3 X . 

Finally, by using the fact that ao + ai = 1, we are able to 
verify that the entropy of pa is given by Eq. ( II It . since pA 
has 2* _1 eigenvalues equal to 1/2* (1 + «o — a.\) and 2*~ x 
equal to 1/2* (1 — a + a±). ■ 

Lemma 11: Let A C P with \A\ > t. Then 

S(A)=S(S) + (2t-l-\A\)log2. (14) 
Proof: Write A = A t U A', where \A t \ = t and \A'\ = 
\A\ - t < t - 1. Let B = P \ A. Then by using Lemmas |9] 
and 1 101 we have 

S(A) > \S(A t )-S(A')\ 

= S(5) + (2t-l-|A|)log2, 

S(A) = S(RB) 

< S{R) + S(B) 

= S(S) + (2t-l-\A\)log2, 

which completes the proof. ■ 
Finally, we have the following. 

Theorem 12: A [[2t— 1, l,t]] binary stabilizer code can be 
used to share a secret according to a ((t, 2t — 1)) QTS. 

Proof: Let A,B = P, such that B = P\A and \A\ > t. 
Then 

l(R : A) = S{R) + S{A) - S{B) 
= 2S(S) = l(R : S). 

Hence, the recoverability requirement is satisfied for any 
authorized set of shares of Eq. and since the threshold 
scheme is pure, this completes the proof. ■ 

IV. Monotone Span Program construction 

In [8] it was shown how (classical) MSP can be used to 
construct a QSS scheme for a general access structure. We 
show that the recoverability and secrecy requirement are 
fulfilled for this construction. 



We only consider the pure state case. The recoverability and 
secrecy requirement for the mixed scheme follow immediately 
from the entropies for the pure scheme. 

Let A be a self-dual adversary structure with corresponding 
MSP (¥ q ,M, g) (see [2]), where q is a prime power, M 
a d x e matrix over ¥ q with independent columns and g 
a function that labels each row of M with an element of 
{1,2, ... ,n}. Furthermore, by H we denote a g-dimensional 
Hilbert space and say the vectors that are labeled {|fl)} ae fj 
form an orthonormal basis for 7i® n . 

Consider the following isometry. 

Definition 13: The mapping V M ■ H® e -► H® d is defined 

by 



i£F, 



i£F„ 



M 



V4 



(15) 



where |V4 V4 • • • ^e) € W® e and a 4 G 



! for every i, 1 < i < q. 



We show that this mapping can be used to share a secret 
according to a QSS with adversary structure A. Let the secret 
S be an element of a q-dimensional Hilbert space fis with 
orthonormal basis {|0), . . . , \q— 1)}. Again, R denotes the 
reference system that purifies S and P denotes the system of 
the players. Let Ir be the identity mapping on the system R. 
The encoding of the secret is then given by 



\RP) = {Ir®V m ){\RS)® \E)), 



where 



\E) 



=f E w 



(16) 



(17) 



and {|a)} aeF e-i is an orthonormal basis for 7is, the Hilbert 
space corresponding to system E. 

This means that if the state of S is described by the density 
matrix ps, which has orthonormal decomposition 



Ps 



(18) 



te¥„ 



then the state of the system of the shares P together with the 
reference system R is given by 



|ap> = -^=E E 



M 



(19) 



Finally, the dealer sends qudit i to player g(i) for 1 < i < d. 

Let A be an authorized set and B its unauthorized comple- 
ment. To check the recoverability and secrecy requirement, we 
compute the entropy of system A and B. By M A and Mb we 
denote the rows of M corresponding to A and B respectively, 
where Ma has rank I and Mb rank m. 

First, consider the following definition. 

Definition 14: Let B l x be the set of vectors \i a\ ■ ■ ■ a e _i) 
such that 



M B (i,ai, . . . ,a e -\) 



where i G ¥ q , a = (a\, . . . , a e _ 
Then the vector ) is defined by 



G F* -1 and ac G im(M B ). 



14) 



i 



E 



Ma 



(21) 



We claim that these vectors are the eigenvectors of the density 
matrix pa that describes the state of system A. To prove this, 
we need the next lemma. 

Lemma 15: Consider two vectors \<fi l x ) and \(f> x ,} for certain 
G F q and x,x' G im(Ms). Suppose there are vectors 



i, i 
\i a 



G Bi and 



G Bi, such that 



M A 



M a 



If there are no such vectors, 



Then we have that \(j) l x ) = |< 
then (4i\tf^) = 0. 

Proof: It is sufficient to show that with the assumptions 
above, we have that for every \i b) G B x , there exist a vector 
|z' ft') G B x \ such that |AfA(i,ft) T ) = \M A (i', b') T ). This is 
fulfilled by setting («',*') = (i',a') - («,a) + 

The second part follows immediately from the fact that we 
labeled the vectors in such a way that they are orthonormal to 
each other. ■ 
Lemma 16: For every % G ¥ q and x G im(Ms), \4> x ) is an 
eigenvector of pa, which has norm equal to 1. 

Proof: The density matrix for subsystem A is given by 



PA 



tr RB \RP)(RP\ 

^rE a< E 



ieF, xGim(M B 



iE«* E i#>wii- 



(22) 



iSF, xeim(Af B ) 



Since M has independent columns and therefore its kernel 
only contains the all zero vector, the vectors \<f> x ) are correctly 
normalized. Because of Lemma [2] we have that the vectors 
\4> x ) are all (not necessarily different) eigenvectors of pa, 
which completes the proof. ■ 

In the next theorem, we compute the entropy of pa by 
calculating the eigenvalues of the eigenvectors of pa- 

Lemma 1 7: Let the matrix M have e independent columns 
and let the rank of matrices Ma and Mb be I and m 
respectively. Then we have 

S(A) = S(S) + (m + Z-e) log q; (23) 

S(B) = (m + l-e)logq. (24) 
Proof: Consider any vector \<j) x ) for i G ¥ q and x G 
im(Ms). Because of Lemma [TBI and the fact that the kernel 
of M only contains the all-zero vector, this vector is repeated 
q e ~ l times in Eq. (I22> . Moreover, because of the properties 
of the MSP and the fact that A is an authorized set, for all 
■ ■*',) we have that i' = i. Therefore, we 



(20) these q e vectors 



can write for pa 



PA 



(25) 



where the vectors \(f>l), with 1 < t < q m + l ^ e and 1 < i < q, 
are all different. Moreover, the vectors \cj) l t ) are all eigenvectors 
of pa, each with eigenvalue a.J q m+l ~ e . Hence, it follows that 
the entropy of system A is given by Eq. (1231 . The proof for 
the entropy of system B is omitted here. ■ 
Finally, we have the following. 

Theorem 18: For any adversary structure A, there exists a 
QSS realizing A. 

Proof: We only prove the case that A is self-dual, the 
scheme for the other adversary structures can be obtained from 
this one. In the case that A is self-dual, consider the scheme 
given by Eq. d!6i . Let A C P, A A be an authorized set 
and B = P \ A. Then because of Lemma 1771 we have 

l(R:S) = S(R) + S(S) - S(RS) = 2S(S); 
l(R:A) = S(R) + S(A)- S(B) =2S(S), 

where we have used the fact that systems RS and RAB are 
in a pure state. The secrecy requirement is equivalent to the 
recoverability requirement in this case, but can also be checked 
directly. ■ 

V. QSS USING Teleportation 

We verify the correctness of the ((n, n)) QTS scheme 
using teleportation as was proposed in [9]. This is done by 
defining an equivalent scheme that does not use teleportation. 

Let the state of the secret S be given by the density matrix 
Ps = a o|0)(0| + ai|l)(l|, where ao,ai € C. The state of S 
together with its reference system R is then given by 



| AS) = V^loo) + VaT|ll) 



(26) 



Suppose the dealer D and the n players P initially share the 
maximally entangled state 

\il>) DP = 4=(|00.. 1 0> + |11.. J)). (27) 



V2 V 

The first step in the teleportation scheme is that the dealer lets 
the secret interact with his part of the entangled state and then 
performs a Bell measurement on his two qubits. If he then 
communicates the (classical) outcome of this measurement to 
the players, they are able to obtain the state 



\RP) = y/^\00_ .M + y^l 1. . •!}• 



(28) 



In [9] it was shown how the players can obtain the state 
of the secret if all of them cooperate. However, it was not 
analyzed what happens if a group of less than n players 
cooperate. This is done here by formulating an equivalent 
protocol in terms of the information theoretical model. Let 
the isometry V n ,„ : C 2 -> (C 2 )®" be defined by 

7 n ,„(a|0) + 6|l)) = a|(L. 1 0)+6|l.. 1 l), (29) 



where a, b G C. The encoding of the secret by using telepor- 
tation is then equivalent to applying the mapping /r® V n . n to 
the system RS, where Ip, is the identity mapping on system R. 
However, the difference is, that with this mapping the dealer 
actually has to send quantum shares to the players, while 
otherwise he only has to perform a Bell measurement and 
sending two classical bits. 

Next, we calculate the mutual informations in order to 
determine which sets of players are authorized. Let Pi be the 
system of player i = 1, 2, . . . , n. Then 



PPi 

PPl2 



ao|0)(0| + ai|l)<l| 
a |00)(00| + ai|ll)(ll| 



(30) 
(31) 



PPl2 



a o |0...0)(0...0|+a 1 |l...l)(l...l|, (32) 



hence the entropy of the system of an arbitrary set of players 
equals the entropy of the secret. For the mutual informations, 
we have 



/(ii:Pi) = l(R:P 12 ) 

l(R:Pi2...n-l) = S(S) 

< l(R : S); 

l(R:Pi2...n) = 2S(5) 

= l(R : S), 



(33) 
(34) 



since RP\2... n is the only system with entropy not equal to 
S(S), but equal to 0. Hence, a set of less than n players has 
some information about the secret, but not enough to recover 
it, while all n players together have enough information to 
recover the secret. Therefore, we have shown that this scheme 
is a non-perfect ((n, n)) QTS. 
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